For example, Google's Project Zero -- a team of security researchers that studies zero-day vulnerabilities -- follows industry guidelines, giving vendors up to 90 days to patch a typical vulnerability before publicly disclosing the flaw.